rancher/rke
1
0
Fork 0
mirror of https://github.com/rancher/rke.git synced 2025-09-25 14:48:06 +00:00
Code Issues Releases Wiki Activity

set the default PodSecurityConfiguration value only if the cluster's k8s version is at least 1.23

Browse Source
This commit is contained in:
Jiaqi Luo
2023-06-14 16:29:39 -07:00
parent 0a57323164
commit e4bf783a1a
2 changed files with 17 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
cluster/defaults.go
View File

@@ -404,8 +404,15 @@ func (c *Cluster) setClusterServicesDefaults() {
c.Services.KubeAPI.EventRateLimit.Configuration == nil { c.Services.KubeAPI.EventRateLimit.Configuration == nil {
c.Services.KubeAPI.EventRateLimit.Configuration = newDefaultEventRateLimitConfig() c.Services.KubeAPI.EventRateLimit.Configuration = newDefaultEventRateLimitConfig()
} }
if len(c.Services.KubeAPI.PodSecurityConfiguration) == 0 { parsedVersion, err := getClusterVersion(c.Version)
c.Services.KubeAPI.PodSecurityConfiguration = PodSecurityPrivileged if err != nil {
logrus.Warnf("Can not parse the cluster version [%s] to determine wether to set the default PodSecurityConfiguration: %v", c.Version, err)
} else {
if parsedRangeAtLeast123(parsedVersion) {
if len(c.Services.KubeAPI.PodSecurityConfiguration) == 0 {
c.Services.KubeAPI.PodSecurityConfiguration = PodSecurityPrivileged
}
}
} }
} }

10
cluster/hosts.go
View File

@@ -167,11 +167,17 @@ func (c *Cluster) getConsolidatedAdmissionConfiguration() (*apiserverv1.Admissio
_ = setPluginConfiguration(admissionConfig, ertConfig) _ = setPluginConfiguration(admissionConfig, ertConfig)
// PodSecurity // PodSecurity
psConfig, err := c.getPodSecurityAdmissionPluginConfiguration() parsedVersion, err := getClusterVersion(c.Version)
if err != nil { if err != nil {
return nil, err return nil, err
} }
_ = setPluginConfiguration(admissionConfig, psConfig) if parsedRangeAtLeast123(parsedVersion) {
psConfig, err := c.getPodSecurityAdmissionPluginConfiguration()
if err != nil {
return nil, err
}
_ = setPluginConfiguration(admissionConfig, psConfig)
}
return admissionConfig, nil return admissionConfig, nil
} }